@xona-labs/xpay 0.2.30 → 0.2.32

package/dist/x402/siwx-free.js

@@ -0,0 +1,116 @@
+/**
+ * SIWX free tier - sign in with the wallet instead of paying.
+ *
+ * Some x402 servers advertise a `sign-in-with-x` (CAIP-122) challenge in the
+ * 402 body's `extensions`, granting free access to wallets that prove
+ * identity - e.g. Xona's $XONA holder tier, where holding the token earns
+ * free daily generations. The flow costs nothing to attempt: sign the
+ * challenge, retry with the SIGN-IN-WITH-X header, and fall back to a normal
+ * paid settlement if the server declines (not enough tokens, quota used, ...).
+ *
+ * Only Solana (ed25519) challenges are attempted here: the paid routes that
+ * offer this perk today are Solana-gated, and the Solana signer's raw
+ * `signMessage` is exactly the primitive SIWS needs.
+ */
+function isObj(v) {
+    return typeof v === "object" && v !== null;
+}
+/**
+ * Pull a Solana SIWX challenge out of a 402 body, if the server offers one.
+ * Returns null when the extension is absent or only offered on chains we
+ * don't sign SIWS for.
+ */
+export function extractSiwxFreeChallenge(data) {
+    if (!isObj(data) || !isObj(data.extensions))
+        return null;
+    const ext = data.extensions["sign-in-with-x"];
+    if (!isObj(ext) || !isObj(ext.info))
+        return null;
+    const info = ext.info;
+    if (!info.domain || !info.uri || !info.nonce || !info.issuedAt)
+        return null;
+    const chains = Array.isArray(ext.supportedChains) ? ext.supportedChains : [];
+    const solana = chains.find((c) => isObj(c) && typeof c.chainId === "string" && c.chainId.startsWith("solana:"));
+    if (!solana)
+        return null;
+    return { info, chainId: solana.chainId };
+}
+/** Build the SIWS (CAIP-122) message text the server verifies against. */
+function buildSiwsMessage(challenge, address) {
+    const { info, chainId } = challenge;
+    const chainRef = chainId.split(":")[1] ?? chainId;
+    const lines = [`${info.domain} wants you to sign in with your Solana account:`, address, ""];
+    if (info.statement)
+        lines.push(info.statement, "");
+    lines.push(`URI: ${info.uri}`, `Version: ${info.version || "1"}`, `Chain ID: ${chainRef}`, `Nonce: ${info.nonce}`, `Issued At: ${info.issuedAt}`);
+    if (info.expirationTime)
+        lines.push(`Expiration Time: ${info.expirationTime}`);
+    if (info.notBefore)
+        lines.push(`Not Before: ${info.notBefore}`);
+    if (info.requestId)
+        lines.push(`Request ID: ${info.requestId}`);
+    if (info.resources && info.resources.length > 0) {
+        lines.push("Resources:");
+        for (const r of info.resources)
+            lines.push(`- ${r}`);
+    }
+    return lines.join("\n");
+}
+/**
+ * Sign the challenge with the wallet's Solana signer and return the value for
+ * the SIGN-IN-WITH-X header (base64 JSON payload, base58 ed25519 signature).
+ * Returns null when the wallet has no Solana signer to sign with.
+ */
+export async function buildSiwxFreeHeader(wallet, challenge) {
+    if (!wallet.has("solana"))
+        return null;
+    const signer = wallet.signer("solana");
+    // Bind the challenge to the host that issued it - a proxied or replayed
+    // challenge for another domain must not be signed.
+    const message = buildSiwsMessage(challenge, signer.address);
+    const sigBytes = await signer.signMessage(new TextEncoder().encode(message));
+    const payload = {
+        domain: challenge.info.domain,
+        address: signer.address,
+        statement: challenge.info.statement,
+        uri: challenge.info.uri,
+        version: challenge.info.version || "1",
+        chainId: challenge.chainId,
+        type: "ed25519",
+        nonce: challenge.info.nonce,
+        issuedAt: challenge.info.issuedAt,
+        expirationTime: challenge.info.expirationTime,
+        notBefore: challenge.info.notBefore,
+        requestId: challenge.info.requestId,
+        resources: challenge.info.resources,
+        signature: encodeBase58(sigBytes),
+    };
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64");
+}
+/** Header the free-tier server echoes the remaining daily quota on. */
+export const SIWX_FREE_REMAINING_HEADER = "x-xona-holder-free-remaining";
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+/** Minimal Base58 encode - avoids pulling in bs58 just for one signature. */
+function encodeBase58(bytes) {
+    let zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0)
+        zeros++;
+    const digits = [];
+    for (let i = zeros; i < bytes.length; i++) {
+        let carry = bytes[i];
+        for (let j = 0; j < digits.length; j++) {
+            carry += digits[j] << 8;
+            digits[j] = carry % 58;
+            carry = (carry / 58) | 0;
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = (carry / 58) | 0;
+        }
+    }
+    let out = "1".repeat(zeros);
+    for (let i = digits.length - 1; i >= 0; i--)
+        out += BASE58_ALPHABET[digits[i]];
+    return out;
+}
+//# sourceMappingURL=siwx-free.js.map

package/dist/x402/siwx-free.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"siwx-free.js","sourceRoot":"","sources":["../../src/x402/siwx-free.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwBH,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2B,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE5E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,CAAC,CAAC,EAA4B,EAAE,CAC9B,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAC/E,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,SAA4B,EAAE,OAAe;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,iDAAiD,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CACR,QAAQ,IAAI,CAAC,GAAG,EAAE,EAClB,YAAY,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,EACjC,aAAa,QAAQ,EAAE,EACvB,UAAU,IAAI,CAAC,KAAK,EAAE,EACtB,cAAc,IAAI,CAAC,QAAQ,EAAE,CAC9B,CAAC;IACF,IAAI,IAAI,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,SAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEvC,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;QACnC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG;QACvB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG;QACtC,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;QAC3B,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;QACjC,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,cAAc;QAC7C,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;QACnC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;QACnC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;QACnC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC;KAClC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AAEzE,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF,6EAA6E;AAC7E,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxB,KAAK,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xona-labs/xpay",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "mcpName": "io.github.xona-labs/xpay",
   "description": "Xona Wallet: agent wallet and payment rail for agentic commerce. Multi-network wallet, x402 payments, AgenC marketplace hires, 20k+ services via PayAI and other catalogs",
   "type": "module",